Red Teaming Experiments
Red Teaming Experiments
linkedin
github
@spotheplanet
patreon
What is ired.team?
Pinned
Pentesting Cheatsheets
Active Directory & Kerberos Abuse
offensive security
Red Team Infrastructure
Initial Access
Code Execution
T1117: regsvr32
T1170: MSHTA
T1196: Control Panel Item
Executing Code as a Control Panel Item through an Exported Cplapplet Function
Code Execution through Control Panel Add-ins
T1191: CMSTP
T1118: InstallUtil
Using MSBuild to Execute Shellcode in C#
T1202: Forfiles Indirect Command Execution
Application Whitelisting Bypass with WMIC and XSL
Powershell Without Powershell.exe
Powershell Constrained Language Mode ByPass
Forcing Iexplore.exe to Load a Malicious DLL via COM Abuse
T1216: pubprn.vbs Signed Script Code Execution
Code & Process Injection
Defense Evasion
Enumeration and Discovery
Privilege Escalation
Credential Access & Dumping
Lateral Movement
Persistence
Exfiltration
reversing, forensics & misc
Windows / OS Internals
Cloud
Neo4j
Dump Virtual Box Memory
AES Encryption Using Crypto++ .lib in Visual Studio C++
Reversing Password Checking Routine
Powered by GitBook

Code Execution

Here are the articles in this section:
T1117: regsvr32
regsvr32 (squiblydoo) code execution - bypass application whitelisting.
T1170: MSHTA
MSHTA code execution - bypass application whitelisting.
T1196: Control Panel Item
Control Panel Item code execution - bypass application whitelisting.
Executing Code as a Control Panel Item through an Exported Cplapplet Function
Code Execution through Control Panel Add-ins
T1191: CMSTP
CMSTP code execution - bypass application whitelisting.
T1118: InstallUtil
InstallUtil code execution - bypass application whitelisting.
Using MSBuild to Execute Shellcode in C#
T1202: Forfiles Indirect Command Execution
Defense Evasion
Application Whitelisting Bypass with WMIC and XSL
Powershell Without Powershell.exe
Powershell Constrained Language Mode ByPass
Understanding ConstrainedLanguageMode
Forcing Iexplore.exe to Load a Malicious DLL via COM Abuse
T1216: pubprn.vbs Signed Script Code Execution
Signed Script Proxy Execution - bypass application whitelisting using pubprn.vbs
Previous
NetNTLMv2 hash stealing using Outlook
Next
T1117: regsvr32
Last updated 2 years ago